| --- |
| page_title: 'Backend Type: consul' |
| description: Terraform can store state in Consul. |
| --- |
| |
| # consul |
| |
| Stores the state in the [Consul](https://www.consul.io/) KV store at a given path. |
| |
| This backend supports [state locking](/language/state/locking). |
| |
| ## Example Configuration |
| |
| ```hcl |
| terraform { |
| backend "consul" { |
| address = "consul.example.com" |
| scheme = "https" |
| path = "full/path" |
| } |
| } |
| ``` |
| |
| Note that for the access credentials we recommend using a |
| [partial configuration](/language/settings/backends/configuration#partial-configuration). |
| |
| ## Data Source Configuration |
| |
| ```hcl |
| data "terraform_remote_state" "foo" { |
| backend = "consul" |
| config = { |
| path = "full/path" |
| } |
| } |
| ``` |
| |
| ## Configuration Variables |
| |
| !> **Warning:** We recommend using environment variables to supply credentials and other sensitive data. If you use `-backend-config` or hardcode these values directly in your configuration, Terraform will include these values in both the `.terraform` subdirectory and in plan files. Refer to [Credentials and Sensitive Data](/language/settings/backends/configuration#credentials-and-sensitive-data) for details. |
| |
| The following configuration options / environment variables are supported: |
| |
| - `path` - (Required) Path in the Consul KV store |
| - `access_token` / `CONSUL_HTTP_TOKEN` - (Required) Access token |
| - `address` / `CONSUL_HTTP_ADDR` - (Optional) DNS name and port of your Consul endpoint specified in the |
| format `dnsname:port`. Defaults to the local agent HTTP listener. |
| - `scheme` - (Optional) Specifies what protocol to use when talking to the given |
| `address`, either `http` or `https`. SSL support can also be triggered |
| by setting then environment variable `CONSUL_HTTP_SSL` to `true`. |
| - `datacenter` - (Optional) The datacenter to use. Defaults to that of the agent. |
| - `http_auth` / `CONSUL_HTTP_AUTH` - (Optional) HTTP Basic Authentication credentials to be used when |
| communicating with Consul, in the format of either `user` or `user:pass`. |
| - `gzip` - (Optional) `true` to compress the state data using gzip, or `false` (the default) to leave it uncompressed. |
| - `lock` - (Optional) `false` to disable locking. This defaults to true, but will require session permissions with Consul and at least kv write permissions on `$path/.lock` to perform locking. |
| - `ca_file` / `CONSUL_CACERT` - (Optional) A path to a PEM-encoded certificate authority used to verify the remote agent's certificate. |
| - `cert_file` / `CONSUL_CLIENT_CERT` - (Optional) A path to a PEM-encoded certificate provided to the remote agent; requires use of `key_file`. |
| - `key_file` / `CONSUL_CLIENT_KEY` - (Optional) A path to a PEM-encoded private key, required if `cert_file` is specified. |